Analysis
-
max time kernel
153s -
max time network
144s -
platform
windows7_x64 -
resource
win7-en-20210920 -
submitted
24-09-2021 12:04
Static task
static1
Behavioral task
behavioral1
Sample
RFQ_Beijing Chengruisi Manufacturing_pdf.exe
Resource
win7-en-20210920
General
-
Target
RFQ_Beijing Chengruisi Manufacturing_pdf.exe
-
Size
417KB
-
MD5
a30b50f5e2ea1a2d8c6bdf581e97d478
-
SHA1
9943026649061e28fe7fd626b6d3e1c893131779
-
SHA256
3dafcb39d7cc251c9a8212a8e745e0d72f2c530bf699a9168a379fa25e36ec38
-
SHA512
548ca8b3f795c32ff30d4f4810e78c6a0bb2aecf42a4bc56632612b2ab5595d9d4d3fd364b6c9bcca80135f1459f7243edc020a2b61bb3b1bce04d43d79a8088
Malware Config
Extracted
xloader
2.5
euzn
http://www.heser.net/euzn/
235296tyc.com
gold12guide.art
baibuaherb.com
weberwines.tax
chezvitoria.com
aidenb.tech
pitchdeckservice.com
surgeryforfdf.xyz
workunvaccinated.com
hrtaro.com
yourotcs.com
sonimultispecialityclinic.com
consultantadvisors.com
pentesting-consulting.com
dantechs.digital
longshifa.online
taweilai.net
imyusuke.com
cashndashfinancial.com
fasiglimt.quest
jakital.com
graywolfdesign.com
pepeavatar.com
predixlogisticscourier.com
football-transfer-news.pro
herbalmedication.xyz
esd66.com
janesgalant.quest
abcrefreshments.com
chaoxy.com
rediscoveringyouhealing.com
mcrjadr5.xyz
n4sins.com
faithful-presence.com
013yu.xyz
isystemslanka.com
newbeautydk.com
ethiopia-info.com
hgaffiliates.net
anodynemedicalmassage.com
esohgroup.com
clinicamonicabarros.com
rafathecook.com
londonescort.xyz
dreamites.com
webtiyan.com
cnnautorepair.com
soposhshop.com
aarohaninsight2021.com
arceprojects.com
mecasso.store
mirai-energy.com
barwg.com
angeescollections-shop.com
xinlishiqiaoqiao.xyz
linuxsauce.net
dirbn.com
anandiaper.xyz
blackpanther.online
livinwoodbridgefarms.com
diepraxiskommunikation.com
radiosaptshahid.com
gofieldtest.com
minxtales.com
Signatures
-
suricata: ET MALWARE FormBook CnC Checkin (GET)
suricata: ET MALWARE FormBook CnC Checkin (GET)
-
Xloader Payload 3 IoCs
Processes:
resource yara_rule behavioral1/memory/1544-60-0x0000000000400000-0x0000000000429000-memory.dmp xloader behavioral1/memory/1544-61-0x000000000041D420-mapping.dmp xloader behavioral1/memory/1428-71-0x00000000000D0000-0x00000000000F9000-memory.dmp xloader -
Deletes itself 1 IoCs
Processes:
cmd.exepid process 572 cmd.exe -
Suspicious use of SetThreadContext 4 IoCs
Processes:
RFQ_Beijing Chengruisi Manufacturing_pdf.exeRFQ_Beijing Chengruisi Manufacturing_pdf.execmstp.exedescription pid process target process PID 2000 set thread context of 1544 2000 RFQ_Beijing Chengruisi Manufacturing_pdf.exe RFQ_Beijing Chengruisi Manufacturing_pdf.exe PID 1544 set thread context of 1384 1544 RFQ_Beijing Chengruisi Manufacturing_pdf.exe Explorer.EXE PID 1544 set thread context of 1384 1544 RFQ_Beijing Chengruisi Manufacturing_pdf.exe Explorer.EXE PID 1428 set thread context of 1384 1428 cmstp.exe Explorer.EXE -
Suspicious behavior: EnumeratesProcesses 23 IoCs
Processes:
RFQ_Beijing Chengruisi Manufacturing_pdf.exeRFQ_Beijing Chengruisi Manufacturing_pdf.execmstp.exepid process 2000 RFQ_Beijing Chengruisi Manufacturing_pdf.exe 1544 RFQ_Beijing Chengruisi Manufacturing_pdf.exe 1544 RFQ_Beijing Chengruisi Manufacturing_pdf.exe 1544 RFQ_Beijing Chengruisi Manufacturing_pdf.exe 1428 cmstp.exe 1428 cmstp.exe 1428 cmstp.exe 1428 cmstp.exe 1428 cmstp.exe 1428 cmstp.exe 1428 cmstp.exe 1428 cmstp.exe 1428 cmstp.exe 1428 cmstp.exe 1428 cmstp.exe 1428 cmstp.exe 1428 cmstp.exe 1428 cmstp.exe 1428 cmstp.exe 1428 cmstp.exe 1428 cmstp.exe 1428 cmstp.exe 1428 cmstp.exe -
Suspicious behavior: MapViewOfSection 6 IoCs
Processes:
RFQ_Beijing Chengruisi Manufacturing_pdf.execmstp.exepid process 1544 RFQ_Beijing Chengruisi Manufacturing_pdf.exe 1544 RFQ_Beijing Chengruisi Manufacturing_pdf.exe 1544 RFQ_Beijing Chengruisi Manufacturing_pdf.exe 1544 RFQ_Beijing Chengruisi Manufacturing_pdf.exe 1428 cmstp.exe 1428 cmstp.exe -
Suspicious use of AdjustPrivilegeToken 3 IoCs
Processes:
RFQ_Beijing Chengruisi Manufacturing_pdf.exeRFQ_Beijing Chengruisi Manufacturing_pdf.execmstp.exedescription pid process Token: SeDebugPrivilege 2000 RFQ_Beijing Chengruisi Manufacturing_pdf.exe Token: SeDebugPrivilege 1544 RFQ_Beijing Chengruisi Manufacturing_pdf.exe Token: SeDebugPrivilege 1428 cmstp.exe -
Suspicious use of FindShellTrayWindow 2 IoCs
Processes:
Explorer.EXEpid process 1384 Explorer.EXE 1384 Explorer.EXE -
Suspicious use of SendNotifyMessage 2 IoCs
Processes:
Explorer.EXEpid process 1384 Explorer.EXE 1384 Explorer.EXE -
Suspicious use of WriteProcessMemory 22 IoCs
Processes:
RFQ_Beijing Chengruisi Manufacturing_pdf.exeExplorer.EXEcmstp.exedescription pid process target process PID 2000 wrote to memory of 1528 2000 RFQ_Beijing Chengruisi Manufacturing_pdf.exe RFQ_Beijing Chengruisi Manufacturing_pdf.exe PID 2000 wrote to memory of 1528 2000 RFQ_Beijing Chengruisi Manufacturing_pdf.exe RFQ_Beijing Chengruisi Manufacturing_pdf.exe PID 2000 wrote to memory of 1528 2000 RFQ_Beijing Chengruisi Manufacturing_pdf.exe RFQ_Beijing Chengruisi Manufacturing_pdf.exe PID 2000 wrote to memory of 1528 2000 RFQ_Beijing Chengruisi Manufacturing_pdf.exe RFQ_Beijing Chengruisi Manufacturing_pdf.exe PID 2000 wrote to memory of 1544 2000 RFQ_Beijing Chengruisi Manufacturing_pdf.exe RFQ_Beijing Chengruisi Manufacturing_pdf.exe PID 2000 wrote to memory of 1544 2000 RFQ_Beijing Chengruisi Manufacturing_pdf.exe RFQ_Beijing Chengruisi Manufacturing_pdf.exe PID 2000 wrote to memory of 1544 2000 RFQ_Beijing Chengruisi Manufacturing_pdf.exe RFQ_Beijing Chengruisi Manufacturing_pdf.exe PID 2000 wrote to memory of 1544 2000 RFQ_Beijing Chengruisi Manufacturing_pdf.exe RFQ_Beijing Chengruisi Manufacturing_pdf.exe PID 2000 wrote to memory of 1544 2000 RFQ_Beijing Chengruisi Manufacturing_pdf.exe RFQ_Beijing Chengruisi Manufacturing_pdf.exe PID 2000 wrote to memory of 1544 2000 RFQ_Beijing Chengruisi Manufacturing_pdf.exe RFQ_Beijing Chengruisi Manufacturing_pdf.exe PID 2000 wrote to memory of 1544 2000 RFQ_Beijing Chengruisi Manufacturing_pdf.exe RFQ_Beijing Chengruisi Manufacturing_pdf.exe PID 1384 wrote to memory of 1428 1384 Explorer.EXE cmstp.exe PID 1384 wrote to memory of 1428 1384 Explorer.EXE cmstp.exe PID 1384 wrote to memory of 1428 1384 Explorer.EXE cmstp.exe PID 1384 wrote to memory of 1428 1384 Explorer.EXE cmstp.exe PID 1384 wrote to memory of 1428 1384 Explorer.EXE cmstp.exe PID 1384 wrote to memory of 1428 1384 Explorer.EXE cmstp.exe PID 1384 wrote to memory of 1428 1384 Explorer.EXE cmstp.exe PID 1428 wrote to memory of 572 1428 cmstp.exe cmd.exe PID 1428 wrote to memory of 572 1428 cmstp.exe cmd.exe PID 1428 wrote to memory of 572 1428 cmstp.exe cmd.exe PID 1428 wrote to memory of 572 1428 cmstp.exe cmd.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\RFQ_Beijing Chengruisi Manufacturing_pdf.exe"C:\Users\Admin\AppData\Local\Temp\RFQ_Beijing Chengruisi Manufacturing_pdf.exe"1⤵
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\RFQ_Beijing Chengruisi Manufacturing_pdf.exe"C:\Users\Admin\AppData\Local\Temp\RFQ_Beijing Chengruisi Manufacturing_pdf.exe"2⤵
-
C:\Users\Admin\AppData\Local\Temp\RFQ_Beijing Chengruisi Manufacturing_pdf.exe"C:\Users\Admin\AppData\Local\Temp\RFQ_Beijing Chengruisi Manufacturing_pdf.exe"2⤵
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: MapViewOfSection
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\Explorer.EXEC:\Windows\Explorer.EXE1⤵
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\autofmt.exe"C:\Windows\SysWOW64\autofmt.exe"2⤵
-
C:\Windows\SysWOW64\autofmt.exe"C:\Windows\SysWOW64\autofmt.exe"2⤵
-
C:\Windows\SysWOW64\autofmt.exe"C:\Windows\SysWOW64\autofmt.exe"2⤵
-
C:\Windows\SysWOW64\autofmt.exe"C:\Windows\SysWOW64\autofmt.exe"2⤵
-
C:\Windows\SysWOW64\autofmt.exe"C:\Windows\SysWOW64\autofmt.exe"2⤵
-
C:\Windows\SysWOW64\autofmt.exe"C:\Windows\SysWOW64\autofmt.exe"2⤵
-
C:\Windows\SysWOW64\autofmt.exe"C:\Windows\SysWOW64\autofmt.exe"2⤵
-
C:\Windows\SysWOW64\cmstp.exe"C:\Windows\SysWOW64\cmstp.exe"2⤵
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: MapViewOfSection
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\cmd.exe/c del "C:\Users\Admin\AppData\Local\Temp\RFQ_Beijing Chengruisi Manufacturing_pdf.exe"3⤵
- Deletes itself
Network
MITRE ATT&CK Matrix
Replay Monitor
Loading Replay Monitor...
Downloads
-
memory/572-69-0x0000000000000000-mapping.dmp
-
memory/1384-66-0x0000000007490000-0x00000000075F8000-memory.dmpFilesize
1.4MB
-
memory/1384-74-0x0000000009160000-0x00000000092BD000-memory.dmpFilesize
1.4MB
-
memory/1384-64-0x0000000007320000-0x000000000748B000-memory.dmpFilesize
1.4MB
-
memory/1428-73-0x0000000000910000-0x00000000009A0000-memory.dmpFilesize
576KB
-
memory/1428-70-0x0000000000A80000-0x0000000000A98000-memory.dmpFilesize
96KB
-
memory/1428-71-0x00000000000D0000-0x00000000000F9000-memory.dmpFilesize
164KB
-
memory/1428-72-0x0000000002030000-0x0000000002333000-memory.dmpFilesize
3.0MB
-
memory/1428-68-0x0000000075C11000-0x0000000075C13000-memory.dmpFilesize
8KB
-
memory/1428-67-0x0000000000000000-mapping.dmp
-
memory/1544-60-0x0000000000400000-0x0000000000429000-memory.dmpFilesize
164KB
-
memory/1544-65-0x0000000000330000-0x0000000000341000-memory.dmpFilesize
68KB
-
memory/1544-62-0x0000000000C70000-0x0000000000F73000-memory.dmpFilesize
3.0MB
-
memory/1544-63-0x0000000000180000-0x0000000000191000-memory.dmpFilesize
68KB
-
memory/1544-61-0x000000000041D420-mapping.dmp
-
memory/2000-54-0x0000000000C00000-0x0000000000C01000-memory.dmpFilesize
4KB
-
memory/2000-59-0x0000000000820000-0x000000000084C000-memory.dmpFilesize
176KB
-
memory/2000-58-0x0000000004470000-0x00000000044CC000-memory.dmpFilesize
368KB
-
memory/2000-57-0x0000000000400000-0x0000000000404000-memory.dmpFilesize
16KB
-
memory/2000-56-0x0000000004E90000-0x0000000004E91000-memory.dmpFilesize
4KB